CVE-2017-5179

Cross-site scripting XSS vulnerability in Tenable Nessus before 6.9.3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2017-5179

CVE-2017-5179 is a stored XSS vulnerability in Tenable Nessus prior to 6.9.3. An authenticated user can inject arbitrary script/HTML into Nessus pages, potentially causing the victim’s browser to execute code in the context of the logged-in user. Affected product/version: Nessus before 6.9.3. Roo...

CVE-2017-5179

Cross-site scripting XSS vulnerability in Tenable Nessus before 6.9.3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

KLA10926 Cross-site scripting vulnerability in Tenable Nessus

Cross-site scripting vulnerability was found in Tenable Nessus. By exploiting this vulnerability malicious users can inject HTML code or arbitrary web script. This vulnerability can be exploited remotely via unspecified vectors. Original advisories Nessus 6.9.3 Release Notes Related products Ness...

Oracle Linux 6 : ghostscript (ELSA-2017-0014)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-0014 advisory. 8.70-211 - Added security fixes for: - CVE-2013-5653 bug 1380327 - CVE-2016-7977 bug 1380415 - CVE-2016-7979 bug 1382305 - CVE-2016-8602 bug 1383940...

Debian DLA-767-1 : curl security update

It was discovered that libcurl's implementation of the printf functions triggers a buffer overflow when doing a large floating point output. The bug occurs when the conversion outputs more than 255 bytes. The flaw happens because the floating point conversion is using system functions without the...

SUSE SLES12 Security Update : samba (SUSE-SU-2016:3299-1)

This update for samba fixes the following issues: Security issues fixed : - CVE-2016-2125: Don't send delegated credentials to all servers. bsc1014441. - CVE-2016-2126: Denial of service due to a client triggered crash in the winbindd parent process. bsc1014442. - CVE-2016-2123: Heap-based Buffer...

Fedora 24 : xen (2016-bc02bff7f5)

two security flaws 1406840 x86 PV guests may be able to mask interrupts XSA-202, CVE-2016-10024 x86: missing NULL pointer check in VMFUNC emulation XSA-203, CVE-2016-10025 x86: Mishandling of SYSCALL singlestep during emulation XSA-204, CVE-2016-10013 1406260 Note that Tenable Network Security ha...

SUSE SLED12 / SLES12 Security Update : gstreamer-plugins-good (SUSE-SU-2016:3303-1)

This update for gstreamer-plugins-good fixes the following security issues : - CVE-2016-9807: Flic decoder invalid read could lead to crash. bsc1013655 - CVE-2016-9634: Flic out-of-bounds write could lead to code execution. bsc1012102 - CVE-2016-9635: Flic out-of-bounds write could lead to code...

SUSE SLES11 Security Update : samba (SUSE-SU-2016:3298-1)

This update for samba provides the following fixes: Security issues fixed : - CVE-2016-2125: Don't send delegated credentials to all servers. bsc1014441 - CVE-2016-2126: Prevent denial of service due to a client triggered crash in the winbindd parent process. bsc1014442 Non security issues fixed ...

SUSE SLED12 / SLES12 Security Update : gstreamer-plugins-bad (SUSE-SU-2016:3296-1)

This update for gstreamer-plugins-bad fixes the following security issues, which would allow attackers able to submit media files for indexing to cause code execution or crashes : - Check an integer overflow CVE-2016-9445 and initialize a buffer CVE-2016-9446 in vmncdec. bsc1010829 - CVE-2016-980...

Debian DLA-776-1 : samba security update

Simo Sorce of Red Hat discovered that the Samba client code always requests a forwardable ticket when using Kerberos authentication. A target server, which must be in the current or trusted domain/realm, is given a valid general purpose Kerberos 'Ticket Granting Ticket' TGT, which can be used to...

Debian DLA-764-1 : qemu security update

Multiple vulnerabilities have been found in QEMU : CVE-2016-9911 Quick Emulator Qemu built with the USB EHCI Emulation support is vulnerable to a memory leakage issue. It could occur while processing packet data in 'ehciinittransfer'. A guest user/ process could use this issue to leak host memory...

Debian DLA-765-1 : qemu-kvm security update

Multiple vulnerabilities have been found in qemu-kvm : CVE-2016-9911 qemu-kvm built with the USB EHCI Emulation support is vulnerable to a memory leakage issue. It could occur while processing packet data in 'ehciinittransfer'. A guest user/process could use this issue to leak host memory,...

Debian DLA-759-1 : nss security update

Franziskus Kiefer reported that the existing mitigations for some timing side-channel attacks were insufficient: https://www.mozilla.org/en-US/security/advisories/mfsa2016-90/CVE-201 6-9074 For Debian 7 'Wheezy', these problems have been fixed in version 2:3.26-1+debu7u2. We recommend that you...

SUSE SLED12 / SLES12 Security Update : samba (SUSE-SU-2016:3271-1)

This update for samba fixes the following issues: Security issues fixed : - CVE-2016-2125: Don't send delegated credentials to all servers. bsc1014441. - CVE-2016-2126: Denial of service due to a client triggered crash in the winbindd parent process. bsc1014442. - CVE-2016-2123: Heap-based Buffer...

SUSE SLED12 / SLES12 Security Update : wget (SUSE-SU-2016:3268-1)

This update for wget fixes the following issues: Security issues fixed : - CVE-2016-7098: Fixed a potential race condition by creating files with .tmp ext and making them accessible to the current user only. bsc995964 Non security issues fixed : - bsc1005091: Don't call xfree on string returned b...

Fedora 25 : gdk-pixbuf2 (2016-a1e8589ef9)

gdk-pixbuf 2.36.2 release. - Remove the pixdata loader 776004 - Fix integer overflows in the jpeg loader 775218 - Add an external thumbnailer for images - Fix a NULL pointer dereference 776026 - Fix a memory leak 776020 - Support bmp headers with bitmask 766890 - Add tests for scaling 80925 -...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2016-3655)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2016-3655 advisory. kernel-uek 4.1.12-61.1.23 - net: Fix use after free in the recvmmsg exit path Arnaldo Carvalho de Melo Orabug: 25298601 CVE-2016-7117 Tenable has extracted...

Oracle Linux 6 : gstreamer-plugins-bad-free (ELSA-2016-2974)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-2974 advisory. 0.10.19-5 - vmncdec: Sanity-check width/height before using it Resolves: rhbz1400820 0.10.19-4 - Remove insecure NSF decoder Resolves: rhbz1400820...